Reverse-engineering an app nobody ships anymore

The question

Older builds of the official Reddit iOS app were written against a Reddit that no longer exists: a pre-OAuth web API, cookie sessions, a X-Modhash header. Those builds are archived, and the oldest of them were shipped without FairPlay encryption, which means their __cstring sections can be read. The question this project asks is narrow and testable:

Do those builds expose API endpoints and embedded configuration that a new third-party client cannot obtain today — and can a modern client be built on them?

The answer is confirmed, partially. The app-only read surface still works with the configuration recovered from a 2016 build; the user surface does not.

The finding

The 2016 app embeds an OAuth client_id next to its scope string. Installed-app clients carry no secret — that is Reddit's design for apps that cannot keep one — so the identifier is the whole credential. It still exchanges for an app-only access token against the live API:

POST https://www.reddit.com/api/v1/access_token
Authorization: Basic <client_id>:
grant_type=https://oauth.reddit.com/grants/installed_client
device_id=<uuid>

A control probe with a random 14-character identifier returns 401, so the exchange is validating the id rather than accepting anything. This matters because Reddit stopped issuing new OAuth client ids to third-party developers; one that predates that change is the scarce thing, not the technique.

The live-validation table on the analysis page shows the full result set: reads answer 200, user-gated endpoints answer 403 USER_REQUIRED, and the pre-OAuth paths are gone.

The method

1. Resolve each archived IPA and hash it; keep the provenance.
2. Triage every IPA for Mach-O encryption (cryptid) and select only builds whose

__TEXT is plaintext. Encrypted builds are out of scope, not merely hard.

1. Recover literals from __cstring / __objc_* and classify hosts, paths, OAuth

configuration, User-Agent template and auth flows. Decompile the networking layer where the string evidence alone is ambiguous.

1. Merge the per-build evidence into one machine-readable inventory with per-item

provenance.

1. Validate the interesting endpoints live, read-only, against public hosts.
2. Ship this client and the API behind it.

This client

The UI is deliberately read-only. An app-only token can read; it cannot vote, comment, submit or moderate. Rather than render controls that would fail, the interface offers none of them — and says so. The OAuth token lives in apps/api and never reaches the browser; every request the page makes is a GET.

Data flow: apps/web → apps/api (token cache, response cache, rate-limit awareness) → oauth.reddit.com. When the API is unreachable, the pages fall back to bundled snapshots so the analysis stays readable; the badge on each page tells you which source you are looking at.

Legal & ethics

• Only already-decrypted, publicly archived IPAs are analysed. No DRM is

circumvented, no decryption is performed, and encryption is detected rather than defeated.

• The archived apps are never executed. Analysis is entirely static.
• Live testing is read-only: token exchanges and GETs against public hosts. No

mutating endpoint was called with real credentials, and no user data was accessed.

• Recovered configuration is treated as sensitive. In this repository it lives in a

git-ignored secrets/ directory; documentation and this UI refer to it in masked form only. The masking is applied at render time as well as at snapshot-generation time, so no secret can leak into the DOM.

• The client identifies itself honestly and respects rate limits.
• This project is unaffiliated with Reddit, Inc. It is an interoperability and archival

exercise, not a service. If you are Reddit and you would like something here changed, that is a reasonable request to make.